# MVP Verification

## Backend

Run:

```powershell
Set-Location backend
go test ./... -v
```

Expected: all backend tests pass.

## PostgreSQL Integration

Set `DATABASE_URL` to the live PostgreSQL test database before running integration checks. Do not commit real credentials.

Run:

```powershell
Set-Location backend
go test -tags integration ./internal/models -run TestPostgresPing -v
```

Expected: `TestPostgresPing` passes.

## Web

The primary frontend is the React + Arco Design client under `apps/web_v1`.

Run:

```powershell
Set-Location apps/web_v1
node scripts/visual-check.mjs
npm run build
npm run lint
```

Expected: visual smoke checks, production build, and lint pass.

## Desktop

Run:

```powershell
Set-Location apps/web_v1
npm run build
Set-Location ../desktop
npm run build
```

Expected: the Tauri desktop executable builds when Rust/Cargo is installed and the stable Rust toolchain is complete.

Installer packaging is a separate step:

```powershell
Set-Location apps/desktop
npm run bundle
```

Current machine status:
- Cargo and rustc are installed under `%USERPROFILE%\.cargo\bin`.
- If the current shell does not see Cargo yet, prepend `%USERPROFILE%\.cargo\bin` to `PATH` or open a new terminal.
- `npx tauri build --no-bundle --verbose` passes and produces `apps/desktop/src-tauri/target/release/senlinai_workbench.exe`.
- Full installer bundling through `npm run bundle` currently times out in the Tauri CLI bundling stage on this machine before producing `target/release/bundle` artifacts.

## Latest Audit Verification

Last audited: 2026-07-18.

- `backend`: `go test ./... -v` passed.
- `apps/web_v1`: `node scripts/visual-check.mjs` passed.
- `apps/web_v1`: `npm run build` passed.
- `apps/web_v1`: `npm run lint` passed.
- `apps/desktop`: `npx tauri build --no-bundle --verbose` passed and produced the desktop executable.
- `apps/desktop`: installer packaging is still blocked by Tauri CLI bundling timeout on the current machine.

Audit fixes included:

- Signed expiring auth session tokens replaced forgeable `user:<id>` tokens.
- Project and inbox HTTP handlers now read the authenticated user from bearer middleware instead of hard-coding user `1`.
- Project dashboard loading now checks project ownership before returning counters.
- Inbox confirmation preserves provenance with `source_inbox_item_id` on generated tasks, notes, and sources.
- Task sharing now rejects note/source links from another project.
- AI user keys are encrypted before storage, decrypted on selection, and can be checked with a per-user action rate limit.
- Web API calls use the backend `/api` prefix, and the active client is now the React + Arco Design workbench.

## Manual MVP Flow

1. Open the client and enter the server IP or domain on the login screen.
2. Create or log in as a private-deployment user.
3. Create a project.
4. Add text to project inbox.
5. Click Analyze/Organize.
6. Confirm one task and one note from the suggestion list.
7. Assign the task to another system user.
8. Explicitly share one note with the task.
9. Search for text from the note body in global search.
10. Open an AI session under the project and reference the note.
11. Use Tauri quick capture to send text into the active project inbox.